100% Latest & Updated Microsoft AZ-400 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 860
A pipeline masks one variable but embeds a token into a generated configuration artifact retained for every developer. Choose TWO measures that implement and verify an effective Azure DevOps response to this specific situation. (Choose TWO.)
- Dismiss the known risk for preventing secret leaks in pipeline logs and artifacts and keep no evidence or accountable owner after deployment.
- Search test logs and generated artifacts for safe secret markers and review access to protected outputs.
- Use secret-aware tasks, masked variables, safe output handling, and controlled artifact content to prevent disclosure.
- Declare preventing secret leaks in pipeline logs and artifacts successful solely from a green pipeline status and skip checking its actual control outcome.
- Bypass review and testing for preventing secret leaks in pipeline logs and artifacts whenever the release deadline is urgent, applying the change to production immediately.
Explanation
Correct Answers
B:Search test logs and generated artifacts for safe secret markers and review access to protected outputs. Secret storage alone does not protect credentials if scripts echo them or package them into published artifacts.
C:Use secret-aware tasks, masked variables, safe output handling, and controlled artifact content to prevent disclosure. Secret storage alone does not protect credentials if scripts echo them or package them into published artifacts. A single logged or packaged credential can give unauthorized users access to sensitive services.
Incorrect Answers
A:Dismiss the known risk for preventing secret leaks in pipeline logs and artifacts and keep no evidence or accountable owner after deployment. It conflicts with the stated operating condition: Secret storage alone does not protect credentials if scripts echo them or package them into published artifacts.
D:Declare preventing secret leaks in pipeline logs and artifacts successful solely from a green pipeline status and skip checking its actual control outcome. It conflicts with the stated operating condition: Secret storage alone does not protect credentials if scripts echo them or package them into published artifacts.
E:Bypass review and testing for preventing secret leaks in pipeline logs and artifacts whenever the release deadline is urgent, applying the change to production immediately. It conflicts with the stated operating condition: Secret storage alone does not protect credentials if scripts echo them or package them into published artifacts.
Question 861
A pull request introduces an injection defect but the repository runs CodeQL only after production deployment. Which implementation BEST addresses the operational issue?
- Connect supported repositories to Defender for Cloud DevOps Security and verify organization and project coverage.
- Enable dependency alerts and controlled update pull requests with ownership, priority, and required regression checks.
- Integrate image vulnerability, dependency, secret, and licensing policy checks before artifact promotion.
- Configure appropriate CodeQL language coverage and PR code scanning with severity-based review requirements.
Explanation
Correct Answer
D:Configure appropriate CodeQL language coverage and PR code scanning with severity-based review requirements. Static analysis helps find source-level risks only when scan coverage includes the changed code and gates are actionable. A green pull request can contain known exploitable source vulnerabilities when relevant code is never analyzed.
Incorrect Answers
A:Connect supported repositories to Defender for Cloud DevOps Security and verify organization and project coverage.
B:Enable dependency alerts and controlled update pull requests with ownership, priority, and required regression checks.
C:Integrate image vulnerability, dependency, secret, and licensing policy checks before artifact promotion.
Question 862
A pull request introduces an injection defect but the repository runs CodeQL only after production deployment. How should the team validate the intended result?
- Compare source repository inventory with connected environments and verify representative finding ingestion and ownership.
- Promote a controlled test image with a known policy violation and confirm its release is blocked or explicitly approved.
- Introduce a controlled test finding in a supported language and confirm scanning reports it before merge.
- Generate a test vulnerable dependency alert and trace the upgrade PR through approval, CI, and closure.
Explanation
Correct Answer
C:Introduce a controlled test finding in a supported language and confirm scanning reports it before merge. Static analysis helps find source-level risks only when scan coverage includes the changed code and gates are actionable.
Incorrect Answers
A:Compare source repository inventory with connected environments and verify representative finding ingestion and ownership.
B:Promote a controlled test image with a known policy violation and confirm its release is blocked or explicitly approved.
D:Generate a test vulnerable dependency alert and trace the upgrade PR through approval, CI, and closure.
Question 863
A pull request introduces an injection defect but the repository runs CodeQL only after production deployment. Which DevOps implementation principle BEST explains the issue?
- Scan findings must influence release authorization and must cover the same immutable image ultimately deployed.
- Static analysis helps find source-level risks only when scan coverage includes the changed code and gates are actionable.
- Central visibility is not equivalent to scanning coverage if source organizations and projects remain unenrolled.
- Vulnerability detection reduces risk only when supported fixes are validated and applied in actual dependent applications.
Explanation
Correct Answer
B:Static analysis helps find source-level risks only when scan coverage includes the changed code and gates are actionable. A green pull request can contain known exploitable source vulnerabilities when relevant code is never analyzed.
Incorrect Answers
A:Scan findings must influence release authorization and must cover the same immutable image ultimately deployed.
C:Central visibility is not equivalent to scanning coverage if source organizations and projects remain unenrolled.
D:Vulnerability detection reduces risk only when supported fixes are validated and applied in actual dependent applications.
Question 864
A pull request introduces an injection defect but the repository runs CodeQL only after production deployment. What preventive practice should be maintained after the fix?
- Review CodeQL workflows and permitted exceptions when build languages or repository structure change.
- Reassess scanning tools, signature trust, and exceptions as base images and dependencies change.
- Track overdue advisories and update failures with risk-based exceptions and compensating controls.
- Reconcile repository onboarding after new teams, orgs, or service connections are added.
Explanation
Correct Answer
A:Review CodeQL workflows and permitted exceptions when build languages or repository structure change. A green pull request can contain known exploitable source vulnerabilities when relevant code is never analyzed.
Incorrect Answers
B:Reassess scanning tools, signature trust, and exceptions as base images and dependencies change.
C:Track overdue advisories and update failures with risk-based exceptions and compensating controls.
D:Reconcile repository onboarding after new teams, orgs, or service connections are added.
Question 865
A pull request introduces an injection defect but the repository runs CodeQL only after production deployment. What outcome most clearly explains the business impact?
- Known high-risk packages or prohibited licenses may be shipped through otherwise reliable pipelines.
- A green pull request can contain known exploitable source vulnerabilities when relevant code is never analyzed.
- Material software supply-chain risks can remain invisible behind a seemingly comprehensive security dashboard.
- An organization can know about vulnerabilities for months without reducing the exposure in production.
Explanation
Correct Answer
B:A green pull request can contain known exploitable source vulnerabilities when relevant code is never analyzed. This is the directly relevant business or security consequence of github advanced security codeql and code-scanning gates. Root cause: Static analysis helps find source-level risks only when scan coverage includes the changed code and gates are actionable.
Incorrect Answers
A:Known high-risk packages or prohibited licenses may be shipped through otherwise reliable pipelines. That risk is relevant to container image and license scanning in microsoft devops pipelines, but the specific unresolved condition here concerns github advanced security codeql and code-scanning gates and has a different direct consequence.
C:Material software supply-chain risks can remain invisible behind a seemingly comprehensive security dashboard. That risk is relevant to defender for cloud devops security repository coverage, but the specific unresolved condition here concerns github advanced security codeql and code-scanning gates and has a different direct consequence.
D:An organization can know about vulnerabilities for months without reducing the exposure in production. That risk is relevant to dependabot alerts and dependency update governance, but the specific unresolved condition here concerns github advanced security codeql and code-scanning gates and has a different direct consequence.
Question 866
A monorepo installs CodeQL but scans one language and omits an internet-facing service written in another language. Which solution should be prioritized to resolve the stated failure?
- Connect supported repositories to Defender for Cloud DevOps Security and verify organization and project coverage.
- Integrate image vulnerability, dependency, secret, and licensing policy checks before artifact promotion.
- Configure appropriate CodeQL language coverage and PR code scanning with severity-based review requirements.
- Enable dependency alerts and controlled update pull requests with ownership, priority, and required regression checks.
Explanation
Correct Answer
C:Configure appropriate CodeQL language coverage and PR code scanning with severity-based review requirements. Static analysis helps find source-level risks only when scan coverage includes the changed code and gates are actionable. A green pull request can contain known exploitable source vulnerabilities when relevant code is never analyzed.
Incorrect Answers
A:Connect supported repositories to Defender for Cloud DevOps Security and verify organization and project coverage.
B:Integrate image vulnerability, dependency, secret, and licensing policy checks before artifact promotion.
D:Enable dependency alerts and controlled update pull requests with ownership, priority, and required regression checks.
Question 867
A monorepo installs CodeQL but scans one language and omits an internet-facing service written in another language. Which evidence would BEST demonstrate that the fix operates as intended?
- Promote a controlled test image with a known policy violation and confirm its release is blocked or explicitly approved.
- Introduce a controlled test finding in a supported language and confirm scanning reports it before merge.
- Generate a test vulnerable dependency alert and trace the upgrade PR through approval, CI, and closure.
- Compare source repository inventory with connected environments and verify representative finding ingestion and ownership.
Explanation
Correct Answer
B:Introduce a controlled test finding in a supported language and confirm scanning reports it before merge. Static analysis helps find source-level risks only when scan coverage includes the changed code and gates are actionable.
Incorrect Answers
A:Promote a controlled test image with a known policy violation and confirm its release is blocked or explicitly approved.
C:Generate a test vulnerable dependency alert and trace the upgrade PR through approval, CI, and closure.
D:Compare source repository inventory with connected environments and verify representative finding ingestion and ownership.
Question 868
A monorepo installs CodeQL but scans one language and omits an internet-facing service written in another language. Which DevOps implementation principle BEST explains the issue?
- Vulnerability detection reduces risk only when supported fixes are validated and applied in actual dependent applications.
- Scan findings must influence release authorization and must cover the same immutable image ultimately deployed.
- Static analysis helps find source-level risks only when scan coverage includes the changed code and gates are actionable.
- Central visibility is not equivalent to scanning coverage if source organizations and projects remain unenrolled.
Explanation
Correct Answer
C:Static analysis helps find source-level risks only when scan coverage includes the changed code and gates are actionable. A green pull request can contain known exploitable source vulnerabilities when relevant code is never analyzed.
Incorrect Answers
A:Vulnerability detection reduces risk only when supported fixes are validated and applied in actual dependent applications.
B:Scan findings must influence release authorization and must cover the same immutable image ultimately deployed.
D:Central visibility is not equivalent to scanning coverage if source organizations and projects remain unenrolled.
Question 869
A monorepo installs CodeQL but scans one language and omits an internet-facing service written in another language. What preventive practice should be maintained after the fix?
- Reconcile repository onboarding after new teams, orgs, or service connections are added.
- Track overdue advisories and update failures with risk-based exceptions and compensating controls.
- Review CodeQL workflows and permitted exceptions when build languages or repository structure change.
- Reassess scanning tools, signature trust, and exceptions as base images and dependencies change.
Explanation
Correct Answer
C:Review CodeQL workflows and permitted exceptions when build languages or repository structure change. A green pull request can contain known exploitable source vulnerabilities when relevant code is never analyzed.
Incorrect Answers
A:Reconcile repository onboarding after new teams, orgs, or service connections are added.
B:Track overdue advisories and update failures with risk-based exceptions and compensating controls.
D:Reassess scanning tools, signature trust, and exceptions as base images and dependencies change.
Question 870
A monorepo installs CodeQL but scans one language and omits an internet-facing service written in another language. What outcome most clearly explains the business impact?
- Material software supply-chain risks can remain invisible behind a seemingly comprehensive security dashboard.
- A green pull request can contain known exploitable source vulnerabilities when relevant code is never analyzed.
- An organization can know about vulnerabilities for months without reducing the exposure in production.
- Known high-risk packages or prohibited licenses may be shipped through otherwise reliable pipelines.
Explanation
Correct Answer
B:A green pull request can contain known exploitable source vulnerabilities when relevant code is never analyzed. This is the directly relevant business or security consequence of github advanced security codeql and code-scanning gates. Root cause: Static analysis helps find source-level risks only when scan coverage includes the changed code and gates are actionable.
Incorrect Answers
A:Material software supply-chain risks can remain invisible behind a seemingly comprehensive security dashboard. That risk is relevant to defender for cloud devops security repository coverage, but the specific unresolved condition here concerns github advanced security codeql and code-scanning gates and has a different direct consequence.
C:An organization can know about vulnerabilities for months without reducing the exposure in production. That risk is relevant to dependabot alerts and dependency update governance, but the specific unresolved condition here concerns github advanced security codeql and code-scanning gates and has a different direct consequence.
D:Known high-risk packages or prohibited licenses may be shipped through otherwise reliable pipelines. That risk is relevant to container image and license scanning in microsoft devops pipelines, but the specific unresolved condition here concerns github advanced security codeql and code-scanning gates and has a different direct consequence.
Designing and Implementing Microsoft DevOps Solutions (AZ-400) Practice Tests
